Apparatus and method for detecting anomalous traffic

Abstract

An apparatus and method for detecting anomalous traffic are provided. More particularly, an apparatus and method for detecting anomalous traffic based on entropy of network traffic are provided. The apparatus of detecting anomalous traffic includes: an entropy extraction module for extracting entropy from network traffic; a visualization module for generating an entropy graph based on the entropy; a graph model experience module for updating a graph model for each network attack based on the entropy graph; and an anomalous traffic detection module for detecting anomalous traffic based on the entropy graph and the graph model for each network attack and outputting the detection results to a user. In the apparatus and method, anomalous traffic is detected based on network entropy rather than simple statistics based on the amount of traffic, so that a false alarm rate of the apparatus for detecting anomalous traffic can be reduced.

Description

CROSS-REFERENCE TO RELATED APPLICATION[0001]This application claims priority to and the benefit of Korean Patent Application No. 2007-120935, filed Nov. 26, 2007, the disclosure of which is incorporated herein by reference in its entirety.BACKGROUND[0002]1. Field of the Invention[0003]The present invention relates to an apparatus and method for detecting anomalous traffic, and more particularly, to an apparatus and method for detecting anomalous traffic based on entropy of network traffic.[0004]2. Discussion of Related Art[0005]The development of network technology has also brought attacks targeting large scale networks such as distributed denial-of-service attacks or worm viruses, which can cause serious social problems. A method, in which a change in the number of packets or the amount of bytes is observed using a traffic characteristics analysis technique to detect anomalous traffic, is suggested as a method for detecting a network attack targeting a large scale network.[0006]How...

AI Technical Summary

Benefits of technology

[0007]The present invention is directed to an apparatus and method for detecting anomalous traffic, which analyzes traffic characteristics changeable according to type of network attack rather than a simple statistical analysis based on the amount of traffic, so that it can detect anomalous traffic more accurately and efficiently.

Problems solved by technology

The development of network technology has also brought attacks targeting large scale networks such as distributed denial-of-service attacks or worm viruses, which can cause serious social problems.

However, the conventional method for detecting anomalous traffic, which depends merely on the change in the amount, has a high false alarm rate.

For example, it does not detect network attacks causing an insignificant change in the amount, or determines an excessive data flow in normal traffic as anomalous traffic.

Images